Prove every contact agreed to be emailed

A regional NBFC branch has collected customer email addresses for years, in a register nobody formalised into an actual consent record — just a column asking for an email, with no note of whether the customer agreed to marketing or simply gave the address for statements. When an audit later asks the branch to show consent for a rate-update campaign, there is nothing concrete beyond 'we have had their email a long time'.

Consent and opt-in capture closes that gap by recording the source, timestamp and method of consent every time a contact joins a list — a signup form, a manual add, an import — and supports a double opt-in confirmation step for stricter proof. Any contact's consent history is visible on request, so the branch, or any business, can show exactly when and how a specific person agreed to be emailed, rather than reconstructing a story after the fact.

India's DPDP Act 2023 sets a specific bar for valid consent: it has to be free, specific, informed, unconditional and unambiguous, given through a clear affirmative action. A pre-checked box that assumes agreement unless unchecked does not meet that bar, nor does inferring marketing consent from an unrelated action, such as giving an email address purely to receive a statement. A contact cannot be added to a marketing list here without a captured affirmative action recorded against them, because anything looser is not consent under the law that governs it.

Bulk imports are the highest-risk path for consent violations, by a wide margin, because they add many contacts at once with no individual affirmative action happening inside this product — the action, if it happened at all, happened elsewhere, outside this system's view. This is why an import requires the uploader to attest to the consent basis for that batch before it proceeds; the tool cannot verify consent independently, but can refuse to treat 'we have their email address' as equivalent to a marketing opt-in, which it plainly is not.

The notice shown at signup matters as much as the click itself. DPDP notice requirements expect plain, simple language describing what data is collected and why, and because that text can reasonably change as practices evolve, the specific version a contact saw when they consented is stored against their record. A business relying on this still has to write that notice honestly; capturing which version was shown protects the record, but does not substitute for the notice being adequate.